CVE-2025-38533

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38533", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.023Z", "datePublished": "2025-08-16T11:12:25.978Z", "dateUpdated": "2026-08-05T12:02:43.501Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:43.501Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: libwx: fix the using of Rx buffer DMA\n\nThe wx_rx_buffer structure contained two DMA address fields: 'dma' and\n'page_dma'. However, only 'page_dma' was actually initialized and used\nto program the Rx descriptor. But 'dma' was uninitialized and used in\nsome paths.\n\nThis could lead to undefined behavior, including DMA errors or\nuse-after-free, if the uninitialized 'dma' was used. Althrough such\nerror has not yet occurred, it is worth fixing in the code."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The defective cache-maintenance calls live in the libwx NAPI receive path (`wx_clean_rx_irq` \u2192 `wx_get_rx_buffer`/`wx_dma_sync_frag`/`wx_alloc_rx_buffers`), driven entirely by frames the NIC receives, including IP traffic routed from arbitrary remote hosts. The frag-sync offset and length are taken directly from remote packet geometry, so an off-link attacker fully drives the code path.\nAC:L - `bi->dma` is deterministically zero on every ring configure (`memset` in `wx_configure_rx_ring`), so every refill and every received packet mis-syncs with 100% reliability \u2014 no race, no memory-layout dependency, no timing window. Simply directing traffic at the interface triggers it.\nPR:N - The path is reached from hardware interrupt/NAPI context on packet arrival, before any protocol parsing, authentication, or socket demultiplexing. An unauthenticated remote sender needs no credentials at all, and the buggy sync also fires on ordinary interface bring-up.\nUI:N - No victim action is needed; an administratively up interface processes attacker-supplied frames automatically. The initial buffer fill in `wx_configure_rx_ring` executes the bad sync even with no traffic.\nS:U - The device descriptor was programmed with the correct `page_dma`, so there is no IOMMU or DMA-boundary bypass \u2014 only CPU-side cache maintenance at a bogus address. Impact stays within the kernel's own security authority.\nC:H - Because the real Rx buffer is never invalidated for CPU access, `wx_build_skb()` copies whatever stale cache contents cover the page \u2014 residual kernel data or prior packets \u2014 into the skb and delivers it via `napi_gro_receive()` to local sockets or back onto the wire. That is an unbounded disclosure of kernel memory contents to a remote party.\nI:H - The skipped `for_device` clean lets dirty CPU cache lines write back over DMA'd packet data, and the bogus `dcache_inval_poc` over `phys_to_virt(0)` discards dirty cache lines belonging to unrelated kernel memory at physical page 0. This is silent kernel memory corruption at an address the driver does not own.\nA:H - On non-coherent platforms the cache-maintenance instruction is issued against `phys_to_virt(0)`, which is outside the linear map whenever DRAM does not start at physical 0, producing an unhandled kernel data abort; corruption of kernel data at physical page 0 likewise leads to a panic. Any remote packet stream sustains the condition."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/wangxun/libwx/wx_lib.c", "drivers/net/ethernet/wangxun/libwx/wx_type.h"], "versions": [{"version": "3c47e8ae113a68da47987750d9896e325d0aeedd", "lessThan": "027701180a7bcb64c42eab291133ef0c87b5b6c5", "status": "affected", "versionType": "git"}, {"version": "3c47e8ae113a68da47987750d9896e325d0aeedd", "lessThan": "ba7c793f96c1c2b944bb6f423d7243f3afc30fe9", "status": "affected", "versionType": "git"}, {"version": "3c47e8ae113a68da47987750d9896e325d0aeedd", "lessThan": "05c37b574997892a40a0e9b9b88a481566b2367d", "status": "affected", "versionType": "git"}, {"version": "3c47e8ae113a68da47987750d9896e325d0aeedd", "lessThan": "5fd77cc6bd9b368431a815a780e407b7781bcca0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/wangxun/libwx/wx_lib.c", "drivers/net/ethernet/wangxun/libwx/wx_type.h"], "versions": [{"version": "6.3", "status": "affected"}, {"version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.100", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.40", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.8", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.100"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.15.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/027701180a7bcb64c42eab291133ef0c87b5b6c5"}, {"url": "https://git.kernel.org/stable/c/ba7c793f96c1c2b944bb6f423d7243f3afc30fe9"}, {"url": "https://git.kernel.org/stable/c/05c37b574997892a40a0e9b9b88a481566b2367d"}, {"url": "https://git.kernel.org/stable/c/5fd77cc6bd9b368431a815a780e407b7781bcca0"}], "title": "net: libwx: fix the using of Rx buffer DMA", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/wangxun/libwx/wx_lib.c", "drivers/net/ethernet/wangxun/libwx/wx_type.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "027701180a7bcb64c42eab291133ef0c87b5b6c5", "status": "affected", "version": "3c47e8ae113a68da47987750d9896e325d0aeedd", "versionType": "git"}, {"lessThan": "ba7c793f96c1c2b944bb6f423d7243f3afc30fe9", "status": "affected", "version": "3c47e8ae113a68da47987750d9896e325d0aeedd", "versionType": "git"}, {"lessThan": "05c37b574997892a40a0e9b9b88a481566b2367d", "status": "affected", "version": "3c47e8ae113a68da47987750d9896e325d0aeedd", "versionType": "git"}, {"lessThan": "5fd77cc6bd9b368431a815a780e407b7781bcca0", "status": "affected", "version": "3c47e8ae113a68da47987750d9896e325d0aeedd", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/wangxun/libwx/wx_lib.c", "drivers/net/ethernet/wangxun/libwx/wx_type.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.100", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.40", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2FFFB27A-1108-4092-B495-80F39EDD8FF9", "versionEndExcluding": "6.6.100", "versionStartIncluding": "6.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0099D5A4-B157-4D36-8858-982C7D579030", "versionEndExcluding": "6.12.40", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C7AFE5B0-F3B1-4D30-B8BF-EDA0385C4746", "versionEndExcluding": "6.15.8", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*", "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*", "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*", "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*", "matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*", "matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*", "matchCriteriaId": "3827F0D4-5FEE-4181-B267-5A45E7CA11FC", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: libwx: fix the using of Rx buffer DMA\n\nThe wx_rx_buffer structure contained two DMA address fields: 'dma' and\n'page_dma'. However, only 'page_dma' was actually initialized and used\nto program the Rx descriptor. But 'dma' was uninitialized and used in\nsome paths.\n\nThis could lead to undefined behavior, including DMA errors or\nuse-after-free, if the uninitialized 'dma' was used. Althrough such\nerror has not yet occurred, it is worth fixing in the code."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: libwx: correcci\u00f3n del uso del DMA del b\u00fafer Rx. La estructura wx_rx_buffer conten\u00eda dos campos de direcci\u00f3n DMA: 'dma' y 'page_dma'. Sin embargo, solo 'page_dma' se inicializ\u00f3 y se utiliz\u00f3 para programar el descriptor Rx. Sin embargo, 'dma' no se inicializ\u00f3 y se utiliz\u00f3 en algunas rutas. Esto podr\u00eda provocar un comportamiento indefinido, incluyendo errores de DMA o use after free, si se utilizaba 'dma' sin inicializar. Si bien este error a\u00fan no se ha producido, conviene corregirlo en el c\u00f3digo."}], "id": "CVE-2025-38533", "lastModified": "2026-07-30T06:23:24.630", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-08-16T12:15:28.957", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/027701180a7bcb64c42eab291133ef0c87b5b6c5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/05c37b574997892a40a0e9b9b88a481566b2367d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5fd77cc6bd9b368431a815a780e407b7781bcca0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ba7c793f96c1c2b944bb6f423d7243f3afc30fe9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: libwx: fix the using of Rx buffer DMA", "id": "2388946", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2388946"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: libwx: fix the using of Rx buffer DMA\nThe wx_rx_buffer structure contained two DMA address fields: 'dma' and\n'page_dma'. However, only 'page_dma' was actually initialized and used\nto program the Rx descriptor. But 'dma' was uninitialized and used in\nsome paths.\nThis could lead to undefined behavior, including DMA errors or\nuse-after-free, if the uninitialized 'dma' was used. Althrough such\nerror has not yet occurred, it is worth fixing in the code."], "name": "CVE-2025-38533", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-08-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38533\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38533\nhttps://lore.kernel.org/linux-cve-announce/2025081656-CVE-2025-38533-6002@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-08-18T20:50:10.519904+00:00", "updated": "2025-08-18T20:50:10.519977+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}